attachmentAV - Virus Scan & Malware Protection for form plugins like Contact Form 7, WPForms, Gravity Forms

Virus scan and malware protection for Contact Form 7, WPForms, Gravity Forms, Formidable Forms, Forminator, Iptanus File Upload, and more. Powered by Sophos.

This plugin requires a subscription and API key: Get API key

Supported Form Plugins

• Contact Form 7 — virus scan and malware protection for Contact Form 7 file uploads
• WPForms — virus scan and malware protection for WPForms file upload fields
• Gravity Forms — virus scan and malware protection for Gravity Forms file upload fields
• Formidable Forms — virus scan and malware protection for Formidable Forms file uploads
• Forminator — virus scan and malware protection for Forminator file upload fields
• Drag and Drop Multiple File Upload for Contact Form 7 — virus scan and malware protection for drag-and-drop file uploads
• Iptanus File Upload — virus scan and malware protection for Iptanus File Upload
• Media Library — virus scan and malware protection for core WordPress media uploads

Screenshot

The WordPress plugin scans file uploads via forms for viruses, trojans, and other kinds of malware. Infected files are blocked and an error is shown to the user.

Installation

Looking for more detailed installation instructions?

1. Install attachmentAV either via the WordPress.org plugin repository or by uploading the files to your server. (See instructions on how to install a WordPress plugin)
2. Activate attachmentAV.
3. Open the attachmentAV plugin settings tab.
4. Create a subscription for the attachmentAV API and enter the API key.

Help and Feedback

Please contact hello@attachmentav.com in case you need help or want to leave feedback. Alternatively, open an issue or send a PR.

Development

To clear the database, run:

docker compose down --volumes

Use the following command to spin up a development environment.

docker compose up

To make email work:

docker ps
CONTAINER ID   IMAGE                  COMMAND  
93b4f65875ae   wordpress:latest       "docker-entrypoint.s…"   6 hours ago   Up 6 hours   0.0.0.0:80->80/tcp                  attachmentav-wordpress-wordpress-1

docker exec -it 93b4f65875ae /bin/bash

apt-get update && apt-get install -y sendmail && apt-get clean
/usr/sbin/sendmail -bd

Optionally use ngrok to get a publicly reachable development domain.

ngrok http http://localhost:80

You might need to set the siteurl an home option in phpMyAdmin to http://localhost or the ngrok URL if this changed since last time.

Inside PHP, use error_log('log line'); or error_log(print_r($var, true)); to print debug logs.

Multisite

A separate compose project spins up a WordPress Multisite Network (subdirectory mode) for testing. It shares port 80 with the single-site environment, so stop one before starting the other.

docker compose down                            # stop the single-site environment
docker compose -f compose.multisite.yaml up    # start the multisite environment

On first start, the wpcli service (see multisite-setup.sh) installs the network, writes the multisite .htaccess rules, and creates two test subsites. When it finishes, the following URLs are available:

• Network admin: http://localhost/wp-admin/network/ (user: admin, password: admin)
• Main site: http://localhost/
• Subsites: http://localhost/site1/ and http://localhost/site2/

Activate the plugin either network-wide or per subsite (also possible via the admin UI):

docker compose -f compose.multisite.yaml run --rm wpcli wp plugin activate attachmentav --network
docker compose -f compose.multisite.yaml run --rm wpcli wp plugin activate attachmentav --url=http://localhost/site1

To reset the multisite database and files:

docker compose -f compose.multisite.yaml down --volumes

Release

• Modify plugin/README.md

  • Update Stable tag
  • Add an item to Changelog

• Modify plugin/attachmentav.php

  • Update the ATTACHMENTAV_VERSION constant
  • Update Version (line 19)

• Commit changes.

• Add and push tag:

git tag -a v1.0.5 -m "v1.0.5"
git push origin main --tags

The workflow release will synchronize the repository with the WordPress SVN to publish the release.